BAA (Business Associate Agreement)

A Business Associate Agreement is the contract HIPAA requires between a covered entity (a healthcare provider, health plan, or clearinghouse) and any vendor that creates, receives, maintains, or transmits Protected Health Information on the covered entity behalf. The BAA legally binds the vendor to the same HIPAA safeguards the covered entity itself is required to follow. Without a signed BAA in place, sending PHI to a vendor is itself a HIPAA violation, regardless of whether the vendor handles the data securely. The agreement is the legal infrastructure that lets PHI move between organizations at all.

For any AI vendor selling into healthcare, the BAA is the gate to the deal. A covered entity cannot adopt a tool that touches patient data without first executing a BAA with the vendor. Many AI tools that work in adjacent verticals fail in healthcare because the underlying infrastructure (OpenAI, Anthropic, Pinecone, etc.) either does not offer BAAs at the relevant tier or offers them only on enterprise contracts that small vendors cannot afford. The vendors that win healthcare deals are the ones who pre-negotiated BAAs with every layer of their stack, paired with HIPAA-compliant AI architecture and a SOC 2 report.

The standard BAA covers permitted uses of PHI, required safeguards (administrative, physical, technical), breach notification obligations, subcontractor flow-down requirements, and termination conditions. Real-world BAAs vary in how prescriptive they are about specific controls. Large health systems often require detailed addendums covering encryption standards, audit log requirements, and data residency. Small clinics may accept a standard form BAA without modification. The AI Ops Department handles the operational layer of BAA tracking, ensuring every vendor in the stack has a current signed agreement and that subcontractor flow-downs are documented for audit.